Malware is now hiding in Google search ads - here's how to protect yourself

"Bad actors have become very good at making malicious downloads look legitimate and even inviting. Sometimes it might be a fake software update, while other times it's a full, convincing workup of a company's support website. And as is the case with a new malware currently making the rounds, it could even be the sponsored ad that appears at the top of your Google search results."

"The latest threat targets people looking to use Claude on Mac and was discovered by security engineer Berk Albayrak, who works with the Trendyol Group. Albayrak shared his findings on LinkedIn, noting that the malware-ridden ad pops up when users search for 'Claude download mac' on Google. If you searched for that term, and then clicked on the infected ad, it would lead you to a legitimate claude.ai page which has instructed for installing the malware embedded in the page."

"It's a very common way of delivering malware, as it asks those who click on it to paste a set of commands into Terminal, which then downloads the infected files to their device. But this campaign isn't just happening across one source, either, as BleepingComputer also discovered a second shared Claude chat being distributed in the same way."

"What makes malware like this latest Claude malware so terrifying for everyday people, is the fact that it looks to run entirely in your computer's memory, thus leaving little trace on your dis"

Malware can be delivered through sponsored ads that appear at the top of Google search results for “Claude download mac.” Clicking the infected ad can redirect users to a legitimate claude.ai page that instructs installation of malware embedded in the page. The installation process commonly asks users to paste commands into Terminal, which then downloads infected files onto the device. The campaign targets people trying to use Claude on Mac and can spread through multiple similar delivery paths, including other shared Claude chats distributed the same way. The threat is especially dangerous because it can run primarily in memory, leaving minimal traces on the system.

Read at MakeUseOf